The wonders of <iframe> embedding.

Otanacious · January 28, 2015, 12:40pm

I've started to use iframe embeds here after seeing a couple posts using it (especially imgur embeds).

Not many forums allow iframe embedding because of all the nasty things that come from being able to embed external webpages, so please thank sb for allowing that ability! Surely there is a 'hosts'-like file to blacklist all the known malware right?

If you're not sure on what the frickle frackle I'm talking about

and a crash course how-to

http://imgur.com/a/Qekov/embed#0

A couple of posts of mine that make use of it.

And maybe a few posts that could make use of it, like the BLF LED Database spreadsheet!

or a community laptop pulls table from downlinx's post!

Being able to do this should mitigate some unnecessary legwork in posting fancy tables or picture galleries.

djozz · January 28, 2015, 12:43pm

nice, thanks for explaining, those examples you mention could definitely use this feature :-)

ChibiM · January 28, 2015, 12:56pm

Ha, I didn't know about this!!!

Good to know!!!

Dimbo_The_Blinky · January 28, 2015, 1:28pm

Here we go again…

Just FYI, and I hope y’all don’t take this personally, but this is how bad that looks on my (1920*1200, Extra Large Fonts, 120DPI) laptop:

Just because something looks “right” on your screen, does not mean everyone can see it that way.

Just sayin’…

Otanacious · January 28, 2015, 1:43pm

Thanks for the heads up. There is an easy solution however. In this case I just have width at 100%. Should be better now, even with ELF and 120DPI.

hank · January 28, 2015, 4:46pm

since clickjacking became popular, enabling [iframe blocking] is probably a good idea
Here’s how IFRAME blocking works, once enabled from NoScript Options|Embeddings|Forbid IFRAMEs:

—IFRAMEs embedded in untrusted pages are always blocked, unless they load content from the same site as their parent

—IFRAMEs embedded in trusted pages are blocked if they try to load content from untrusted sites

—If NoScript Options|Embeddings|Apply these restrictions to trusted sites too is checked, no IFRAME can be loaded unless it loads content from the same site as its parent

—In every case, IFRAMEs loading content from the same site as their parent are allowed.*

When an IFRAME is blocked, you can see a clickable yellow placeholder which you can use either to examine its URL, save the document without opening it or activate it on the fly.

if you want every iframe to be blocked, even if same-site with its parent, you can set the noscript.forbidIFramesContext about:config preference to 0 (zero)

You have to ask yourself, do I trust every person who is or may be registered at this site?
If not, narrow down a whitelist to allow only those you know and trust

Clickjacking — you know how to look this stuff up, if you don’t already know why worry.

Racer · January 28, 2015, 9:51pm

Neat concept, but that tag causes as many problems as it solves. And I think you are begging to be exploited by enabling it on forums. I personally don’t use them for paying clients and would advise any clients against using them. For dabbling around like the OP’s example, sure, but I wouldn’t build an insurance claims system or e-commerce web site with those iframe tags. And most frameworks like ASP .Net, Drupal, Wordpress, etc., make them superfluous anyway.

Otanacious · January 28, 2015, 10:37pm

Yeah I agree with both of you, and a +1 to hank's suggestion of a whitelist, but maybe not for specific people as to specific services with a fairly reputable stature (Google Drive, YouTube, imgur, Flickr).